5 ms·

tl;dr - You're holding it wrong. Seriously, is the HN audience really that non-technical these days? Lol. I don't know what the clown who wrote that post is

tl;dr - You're holding it wrong. Seriously, is the HN audience really that non-technical these days? Lol. I don't know what the clown who wrote that post is thinking, or the person that submitted it was, but seriously, how the heck did you think password storage works? It's like when everybody got up in arms about Pidgin storing passwords in cleartext. Heck, they even made a page explaining the rationale: https://developer.pidgin.im/wiki/PlainTextPasswords https://developer.pidgin.im/wiki/PlainTextPasswords I encourage the author as well as the submitted to read that. Anything you did to obscure it would just give you a false sense of security.

voltagex_ 13y ago
Even encrypting the password store on-disk? What's Keepass doing?
- rpsw 13y ago
  That would be the first approach mentioned in the Wiki article: Store a password(s) behind a password In KeePass, a passphrase or a key file act as the encryption key.
stephenr 13y ago
I don't know what you're thinking. Storing multiple encrypted passwords behind a single "master" password (in the case of Windows and OSX its usually the OS level User password) is a common way to provide convenience and security for users.
- victorhooi 13y ago
  Well, that's what a login password and a lockscreen are for. I mean, these things are secure and well-tested - I'm not sure why people aren't using them? Do you somehow think that your OS is more insecure? I don't think you've exactly explained what exactly you're trying to protect against. Is it casual attacker who happen to chance upon an unattended computer? Well, in that case, either your computer is locked, or it's pretty much game over. There is no additional security you can get by just obfuscating it.
  - stephenr 13y ago
    My issue is that chrome blatantly ignores the user's decision about when it can access a stored password, and creates its own copy, giving itself arbitrary access to said item. This doesn't affect me personally in the slightest, I don't use Chrome for anything but debugging, but claiming this is anything other than Google doing what Google does best (fucking the user) is short sighted.

voltagex_ 13y ago

Even encrypting the password store on-disk? What's Keepass doing?

rpsw 13y ago
That would be the first approach mentioned in the Wiki article: Store a password(s) behind a password In KeePass, a passphrase or a key file act as the encryption key.

stephenr 13y ago

I don't know what you're thinking. Storing multiple encrypted passwords behind a single "master" password (in the case of Windows and OSX its usually the OS level User password) is a common way to provide convenience and security for users.

victorhooi 13y ago
Well, that's what a login password and a lockscreen are for. I mean, these things are secure and well-tested - I'm not sure why people aren't using them? Do you somehow think that your OS is more insecure? I don't think you've exactly explained what exactly you're trying to protect against. Is it casual attacker who happen to chance upon an unattended computer? Well, in that case, either your computer is locked, or it's pretty much game over. There is no additional security you can get by just obfuscating it.
- stephenr 13y ago
  My issue is that chrome blatantly ignores the user's decision about when it can access a stored password, and creates its own copy, giving itself arbitrary access to said item. This doesn't affect me personally in the slightest, I don't use Chrome for anything but debugging, but claiming this is anything other than Google doing what Google does best (fucking the user) is short sighted.